Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[ci] Use sign-artifacts template for macOS signing #9091

Merged
merged 14 commits into from
Jul 16, 2024
Merged

[ci] Use sign-artifacts template for macOS signing #9091

merged 14 commits into from
Jul 16, 2024

Conversation

pjcollins
Copy link
Member

@pjcollins pjcollins commented Jul 9, 2024 •
edited
Loading

Context: https://github.com/xamarin/yaml-templates/pull/317

We've been hitting a lot of issues recently in the macOS developer
signing steps that run during the build. Mono MSBuild has been crashing,
and signing service requests have been timing out.

The macOS developer signing steps have been moved to the post build
signing job that runs on Windows agents to try to mitigate these issues.

@dotnet dotnet deleted a comment from azure-pipelines bot Jul 10, 2024
@jonathanpeppers jonathanpeppers mentioned this pull request Jul 10, 2024
Merged
@pjcollins pjcollins mentioned this pull request Jul 11, 2024
Merged
@pjcollins pjcollins marked this pull request as ready for review July 16, 2024 17:38
@pjcollins pjcollins requested a review from jonpryor as a code owner July 16, 2024 17:38
@pjcollins
Copy link
Member Author

Finally managed to get through all the issues and various outages, and the latest test build looks good: https://devdiv.visualstudio.com/DevDiv/_build/results?buildId=9889091&view=results

Checking a few files randomly in the Darwin pack the signatures seems right:

tools % codesign -dv --verbose=4 Darwin/aapt2
Executable=/Users/peter/Downloads/Microsoft.Android.Sdk.Darwin.35.0.0-ci.dev-pjc-macsign-template.21/tools/Darwin/aapt2
Identifier=aapt2-555549444c4c446e55553144a1a4e01cffdb06ce
Format=Mach-O universal (x86_64 arm64)
...
Authority=Developer ID Application: Microsoft Corporation
Authority=Developer ID Certification Authority
Authority=Apple Root CA

tools % codesign -dv --verbose=4 Darwin/binutils/lib/liblldCOFF.dylib
Executable=/Users/peter/Downloads/Microsoft.Android.Sdk.Darwin.35.0.0-ci.dev-pjc-macsign-template.21/tools/Darwin/binutils/lib/liblldCOFF.dylib
Identifier=liblldCOFF
Format=Mach-O universal (x86_64 arm64)
...
Authority=Developer ID Application: Microsoft Corporation
Authority=Developer ID Certification Authority
Authority=Apple Root CA

@pjcollins pjcollins requested a review from jpobst July 16, 2024 18:50
jonathanpeppers
jonathanpeppers reviewed Jul 16, 2024
View reviewed changes
Copy link
Member

@jonathanpeppers jonathanpeppers left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will we have any issues taking this back to .NET 8? Wondering how many total commits would be required.

build-tools/create-packs/SignList.xml
Comment on lines +29 to +35
<MacDeveloperSign Include="*.dylib" />
<MacDeveloperSignHarden Include="Darwin/aapt2" />
<MacDeveloperSignHarden Include="Darwin/binutils/bin/*as" />
<MacDeveloperSignHarden Include="Darwin/binutils/bin/*ld" />
<MacDeveloperSignHarden Include="Darwin/binutils/bin/llc" />
<MacDeveloperSignHarden Include="Darwin/binutils/bin/llvm-mc" />
<MacDeveloperSignHarden Include="Darwin/binutils/bin/*strip" />
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Previously, we used an item group like @(_MSBuildFilesUnixSignAndHarden) or @(_BinUtilsFilesUnixSign), is there a chance we might miss a file?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is possible, but we have signing validation steps in place that should catch any file additions that don't have a corresponding signlist update. We could look to partially generate this in the future, though I'd like to try to get this in to help ease all of the signing pain we've been hitting over the last few weeks.

@pjcollins
Copy link
Member Author

Will we have any issues taking this back to .NET 8? Wondering how many total commits would be required.

I don't think we will need to backport this, as the recent changes to use dotnet build and disable CodeQL on non-main branches should get us building again there.

@pjcollins pjcollins merged commit b01de22 into main Jul 16, 2024
65 of 68 checks passed
@pjcollins pjcollins deleted the dev/pjc/macsign-template branch July 16, 2024 20:10
grendello added a commit that referenced this pull request Jul 23, 2024
@grendello
Merge branch 'main' into dev/grendel/perfetto-integration
37c8656 
* main: (23 commits)
  Localized file check-in by OneLocBuild Task (#9129)
  [ci] Disable CodeQL on CI/PR pipelines (#9128)
  Refine 16k page alignment support (#9075)
  [build] fix `ConfigureLocalWorkload` target (#9124)
  Bump to NDK r27 (#9020)
  [ci] Use drop service for SDK insertion artifacts  (#9116)
  Fix up all mapping paths (#9121)
  [ci] Fix maestro publishing for stable packages (#9118)
  Bump to dotnet/sdk@2f14fea98b 9.0.100-preview.7.24367.21 (#9108)
  Missing androidx.window.[extensions|sidecar] warnings (#9085)
  [ci] Use sign-artifacts template for macOS signing (#9091)
  [ci] Use DotNetCoreCLI to sign macOS files (#9102)
  [ci] Disable CodeQL on macOS, Linux, non-main jobs (#9111)
  [tests] re-enable `JavaAbstractMethodTest` (#9097)
  [Microsoft.Android.Sdk.ILLink] preserve types with `IJniNameProviderAttribute` (#9099)
  [Mono.Android] Data sharing and Close() overrides (#9103)
  [AndroidManifest] Add `Android.App.PropertyAttribute` (#9016)
  [Mono.Android] Add support for AndroidMessageHandler ClientCertificates (#8961)
  [Mono.Android] Bind and enumify API-35 (#9043)
  Bump to dotnet/java-interop@7a058c0e (#9066)
  ...
@github-actions github-actions bot locked and limited conversation to collaborators Aug 16, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@jonathanpeppers jonathanpeppers jonathanpeppers approved these changes

@jonpryor jonpryor Awaiting requested review from jonpryor jonpryor is a code owner

@jpobst jpobst Awaiting requested review from jpobst

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@pjcollins @jonathanpeppers